485 Commits

Author	SHA1	Message	Date
enricobuehler	767f028bdf	feat(host): PyroWave encoder — Phase 1 of the LAN low-latency codec plan ... PyroWaveEncoder behind --features pyrowave + an explicit PUNKTFUNK_ENCODER=pyrowave (loud EXPERIMENTAL warning: no client can decode the stream until CODEC_PYROWAVE negotiation lands, plan Phase 2). Design (plan §4.3): a private ash Vulkan-1.3 device shared with pyrowave via pyrowave_create_device — DeviceHold pins the instance/device create-infos the 0.4.0 API requires alive for the device's lifetime. Capture dmabufs pass straight through on ANY vendor (linux_zero_copy_is_vaapi → true for pyrowave; NVIDIA dmabuf→Vulkan import validated by upstream's interop test on .21) with the same per-buffer import cache as the Vulkan Video backend; the shared rgb2yuv.comp BT.709-limited CSC writes R8+RG8 images pyrowave samples directly (R/G view swizzles synthesize Cb/Cr — no NV12 copy). Encode records into OUR command buffer (pyrowave_device_set_command_buffer), so ingest + CSC + encode are one submission with a sub-ms fence wait; the AU is exactly one pyrowave packet, keyframe=true on every frame. reconfigure_bitrate is a free in-place budget change (Phase 3 pins the session rate); reset() recreates only the pyrowave encoder object. Shared ash leaf helpers (dmabuf import, image/memory utils) extracted from vulkan_video.rs into encode/linux/vk_util.rs — vulkan-encode builds unchanged. Validated on .21 (RTX 5070 Ti): pyrowave_smoke green — encodes CPU fills through the full open→CSC→GPU-encode→packetize path, decodes every AU with upstream's own decoder, checks BT.709 plane means ±3; rate retarget + rebuild covered. clippy clean, 308 host tests green with the feature on. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-15 00:58:02 +02:00
enricobuehler	d2b4e3d71c	fix(host): warn loudly when a CUDA session runs a build without direct-SDK NVENC ... The nvenc feature is off by default, and a Linux host built without --features punktfunk-host/nvenc silently compiles the direct-SDK path out: a CUDA session degrades to libav hevc_nvenc — no RFI loss recovery, an encoder rebuild + IDR on every adaptive-bitrate step, and the libav bitrate clamp — with nothing in the logs saying why. This bit the Linux packagers once (fixed in e89b2f60) and an ad-hoc host deploy again on 2026-07-14, where the on-glass Automatic-climb session showed rebuild-per-step behavior that read as a pipeline gap (it wasn't: the Portal/PipeWire path delivers EGL-imported CUDA NV12 frames and goes direct whenever the feature is in the build). One WARN per process, skipped under an explicit PUNKTFUNK_NVENC_DIRECT=0. Validated on .21 (GNOME/Mutter Portal capture, feature build): probe session logs `Linux direct-SDK NVENC`, and probe --rebitrate lands as `encoder bitrate reconfigured in place (adaptive bitrate — no IDR)`. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-15 00:03:26 +02:00
enricobuehler	9d67dc18aa	perf(core): two-lane AES-GCM seal for large frames + send-thread stage split ... Phase 0.4 host half: PUNKTFUNK_PERF now splits the send thread per window into fec/seal/sock (SealPerf via Session::take_seal_perf; the paced video path folds its chunk-send time in through note_sock_ns), logged with per-packet ns in the send loop's perf line. Measured on .21 at 2.5 Gbps offered: fec ~100 ns/pkt (Phase 1.4 landed), seal ~1000 ns/pkt = 21.5% of a core, sock ~1400 ns/pkt — the Phase 1.5 gate (seal > ~15% of the thread at 2 Gbps) trips. Phase 1.5: seal_frame_inner is now write-then-seal — packetize writes every packet's plaintext at its final wire offset, then a frame of >= 256 wire packets (~300 KB) splits the AES-GCM pass across two lanes: a persistent punktfunk-seal2 worker (lazy-spawned, rendezvous channels, no per-frame spawn, zero steady-state allocs via a reused hand-off Vec) seals the back half under nonces seq_base+i while the send thread seals the front. Nonce order is deterministic per shard index, so the wire is byte-identical to the sequential pass — pinned by the wire-equivalence test, now including a 469-packet frame plus an assertion that the lane actually spawned. Small frames and the probe's ~17-packet AUs stay single-lane; PUNKTFUNK_SEAL_LANES=1 forces single-lane. Validated: 84 core tests + workspace suites + clippy -D warnings on .21. Halves the seal wall-clock on big frames — headroom for the 10G pair's ~4.8 Gbps ceiling (seal alone would be ~47% of a core there) and PyroWave 4K rates. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 23:47:33 +02:00
enricobuehler	f4f6c5556f	perf(core): FEC encoder reuse — cached codecs + pooled parity, no per-block setup ... Phase 1.4 (throughput-beyond-1gbps.md): the send path built a fresh erasure codec and allocated fresh parity Vecs for every FEC block. New trait method ErasureCoder::encode_into generates parity into caller-pooled buffers; the packetizer keeps one parity pool that grows once to the session's high-water recovery count. - gf16: one cached reed_solomon_simd::ReedSolomonEncoder per coder, re-shaped per block via reset() (reuses its working space) — the old encode() convenience call paid engine CPU-feature detection, FFT planning, and work-buffer allocation per block. - gf8: last-used (k, m) Cauchy codec cached, so the generator-matrix build drops out of steady-state frames; parity buffers shaped without re-zeroing (encode_sep's first-input pass overwrites every row). The GameStream VideoPacketizer now owns a persistent coder so the cache survives frames. - encode() delegates to encode_into — one code path, and the nanors byte-exact parity vector keeps pinning Moonlight wire compatibility. Validated: 145 core + 308 host tests + clippy -D warnings on .21, loss-harness recovery curve identical, pipeline bench +0.6-2.4% thrpt (all configs, p<0.05; the loopback bench is encoder-dominated so the alloc savings mostly land outside it). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 23:19:21 +02:00
enricobuehler	5c7e0afa99	fix(host): Linux virtual-pad feedback access — hidraw udev rules, per-pad DS MAC, SET_REPORT acks ... Root-cause fixes for "rumble + adaptive triggers never work with Linux hosts" (the capture code itself was proven good on-hardware — see the new tests): * 60-punktfunk.rules now grants the `input` group the VIRTUAL pads' hidraw nodes (DS/Edge/DS4/Switch/Deck/SC). Steam/SDL drive DualSense adaptive triggers, lightbar, and player LEDs exclusively over hidraw — and Steam without hidraw demotes a PlayStation pad to a generic evdev device, losing its rumble handling too. Coverage no longer depends on the distro's steam-devices rules + logind's active-seat uaccess ACL (which a headless/ dedicated streaming session never gets). Verified live: nodes now come up root:input 0660. * Per-pad MAC in the DualSense (0x09) and DS4 (0x12) pairing feature replies: hid-playstation adopts the MAC as the HID uniq and SDL/Steam dedup controllers by that serial — identical MACs made a second virtual pad read as the first one re-connecting over another transport. * DualSense/DS4 UHID backends now ack UHID_SET_REPORT (err=0) instead of ignoring it, so a SET_REPORT writer no longer blocks on the kernel's 5 s timeout. * New #[ignore] on-box tests play the GAME's role against a real kernel and pin the full feedback surface (all green on real hw): DualSense evdev-FF + raw hidraw output report (rumble/lightbar/LEDs/both trigger blocks verbatim, per-pad uniq), uinput X-Box FF upload→pump→stop-on-erase, and usbip Deck 0xEB rumble via the controller interface (idle interfaces ACK silently, like real hardware). Windows note: the UMDF driver keeps its own pairing blob copies — the shared- MAC dedup hazard exists there too and needs a driver-side follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 21:47:13 +02:00
enricobuehler	5a384fe788	feat(host): pace-aware send chunking — high-rate frames pace honestly instead of blasting ... Phase 1.2: the native plane's pace chunks are rate-adaptive — 16 packets at today's rates, coarsening until the per-chunk interval clears the 500 µs sleep floor, capped at 64 (the GSO segment limit). Decouples the syscall batch from the pace step, so a ≥1 Gbps frame's overflow keeps real sleeps between chunks (and costs 4× fewer syscalls) instead of collapsing into an unpaced blast. Phase 1.3: the auto microburst cap scales with the frame — max(128 KB, the AU's wire bytes / 4) — so high-rate frames burst a bounded quarter and pace the rest; PUNKTFUNK_PACE_BURST_KB now pins an absolute override. GameStream plane untouched (its schedule stays pinned by the deterministic tests, now also asserting budget-independence). Linux GSO latch-off warns once (was silent; USO already warned). Linux GSO default stays OPT-IN: the post-1.2/1.3 A/B on the 2.5GbE-hop pair (.21 → M3 Ultra) reproduced the regression bit-for-bit — 2452 Mbps sendmmsg vs 1909 GSO peak, 0.4% loss at 1500 where sendmmsg is clean. The super-buffer trains lose on the constrained hop in the transport path itself (per-AU probe sends, no video pacer involved), so the block is fabric evidence, not pacing readiness. Control sweep on this build matched the sendmmsg baseline exactly (2452); loss-harness recovery curve identical; workspace clippy + tests green on .21. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 21:38:06 +02:00
enricobuehler	a87b279c2b	test(host): Windows on-hardware NVENC reconfigure smoke — 20→60→10 Mbps in place, zero IDRs ... The Windows twin of nvenc_cuda_reconfigure_no_idr, green on the .173 RTX box (release profile — the dev-profile test binary trips a pre-existing LNK2019 on the sdk crate's unused safe EncodeAPI statics, which release LTO strips). Chasing this also uncovered why the live A/B kept rebuilding: the PunktfunkHost service runs C:\Users\Public\punktfunk-native's exe, not the Developer clone deploy-host.ps1 had been rebuilding. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 20:20:29 +02:00
enricobuehler	9bf72cdfb5	fix(host): forward reconfigure_bitrate through TrackedEncoder + probe --rebitrate validator ... The gpu-session TrackedEncoder wrapper delegates every Encoder method by hand, so the new reconfigure_bitrate fell through to the trait's false default and EVERY bitrate change silently took the rebuild+IDR path — the live .21 A/B caught it (host log said 'rebuilt', never 'in place'). Also: - punktfunk-probe --rebitrate KBPS:SECS — headless mid-stream SetBitrate validator (cursor-wiggles so a damage-driven idle desktop keeps publishing frames through the switch). Live-verified on .21: one NVENC session open, then 'encoder bitrate reconfigured in place (adaptive bitrate — no IDR)' at 20→60 Mbps. - on-hardware nvenc_cuda reconfigure smoke test (20→60→10 Mbps in place, zero IDRs — green on the RTX 5070 Ti). - BitrateChanged doc no longer claims the switch costs an IDR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 20:06:56 +02:00
enricobuehler	a1af916e38	feat(host): in-place encoder rate reconfigure — ABR steps no longer cost an IDR ... Every adaptive-bitrate step used to tear the encoder down and rebuild it, opening on a full IDR (a 20-40x frame-size spike, in-flight AU forfeit and an IDR-cooldown anchor) — exactly when the Automatic controller is climbing. Encoder::reconfigure_bitrate(bps) retargets the LIVE encoder instead (default false, so libavcodec/software paths keep the rebuild fallback, which also still owns the bitrate clamping): - Linux + Windows direct NVENC: nvEncReconfigureEncoder (added to the hand-rolled runtime EncodeApi tables) with resetEncoder=0 / forceIDR=0; the same init/config is re-authored via the new shared build_config/ build_init_params with only avg/max bitrate + VBV (PUNKTFUNK_VBV_FRAMES) moved. On-hardware test: 20→60→10 Mbps in place, zero IDRs (RTX 5070 Ti). - Native AMF: TargetBitrate/PeakBitrate/VBVBufferSize are dynamic properties — SetProperty on the live component, no Terminate/re-Init. - Vulkan Video (HEVC + AV1): stage the rate and emit an ENCODE_RATE_CONTROL control command on the next recorded frame (begin keeps declaring the session's current state, as the spec requires). The session glue tries the in-place retarget first and skips the rebuild/ inflight-clear/IDR-cooldown bookkeeping when it succeeds — the reference chain and the wire-index prediction survive, so RFI keeps working across rate steps. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 19:53:18 +02:00
enricobuehler	9b7fc127ef	feat(core): Automatic bitrate scales to measured link capacity — probe ceiling + slow start ... The ABR ceiling was the negotiated start rate, so an 'Automatic' session was permanently boxed at the 20 Mbps default no matter the link — the most user-visible cap left after the transport work lifted the client receive ceiling to ~4.8 Gbps wire. - Startup link-capacity probe: ~2 s into an Automatic session the pump fires one speed-test burst (2 Gbps target, 800 ms) over the existing ProbeRequest machinery; delivered wire throughput x0.7 (FEC + variance headroom) becomes the controller's climb ceiling via set_ceiling(). Old hosts decline (all-zero reply) or never answer (a 6 s timeout clears the stuck probe state so LossReports resume) — the ceiling then stays negotiated, exactly the old behavior. PUNKTFUNK_ABR_PROBE=0 opts out. - Slow start: until the first congestion signal, every cooled clean window DOUBLES the rate toward the ceiling (20 Mbps -> 640 Mbps in ~10 s) instead of +6% per ~10 s (which would have taken ~10 minutes). Any congestion signal ends it for good; classic AIMD takes over. - Faster, severity-aware AIMD: a SEVERE window (unrecoverable frame, jump-to-live flush, or >=6% loss) backs off x0.7 immediately instead of waiting two windows; ordinary congestion (2-6% loss, OWD rise) keeps the two-window fuse. Additive climbs need 6 clean windows (~4.5 s, was ~10 s); the change cooldown drops 3 s -> 1.5 s. - PUNKTFUNK_VBV_FRAMES now also scales the direct-NVENC VBV (Windows + Linux, previously hardwired to 1 frame) — parity with AMF/VAAPI/QSV. Each accepted step still costs an encoder rebuild + IDR on the host; in-place rate reconfigure (NvEncReconfigureEncoder / AMF dynamic properties / Vulkan per-frame RC) is the planned follow-up that makes stepping free. Controller tests rewritten to the new policy (severity classes, slow-start climb, ceiling semantics; 144 green). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 19:28:11 +02:00
enricobuehler	85513d1697	fix(host/linux): headless gamescope must not inherit a desktop DISPLAY/WAYLAND_DISPLAY ... A host (re)started after a desktop login inherits the user manager's compositor env; a stale WAYLAND_DISPLAY makes headless gamescope 3.16 exit at startup ('Failed to connect to wayland socket') before its PipeWire node appears. Unset both on the systemd-run transient unit (UnsetEnvironment=) and the direct spawn (env_remove) — gamescope exports its own DISPLAY/GAMESCOPE_WAYLAND_DISPLAY to the nested app. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 19:07:41 +02:00
enricobuehler	840e5d590e	fix(host/linux): free a desktop-session Steam before a dedicated gamescope launch ... B1b: a Steam running in a plain GNOME/KDE desktop session holds Steam's single instance, so a dedicated gamescope launch's own Steam exits at birth — the game-library launch goes to a black screen. Release the desktop instance (free_desktop_steam) on Steam launches before creating the managed session. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 16:32:29 +02:00
enricobuehler	f3b6ccaa7f	fix(gamepad/windows): Steam-accepted Deck unit serial un-mangles the controller name ... Steam validates the Deck unit serial's format before accepting it. Our "PFDK..." serial was REJECTED ("Invalid or missing unit serial number"), so Steam substituted a hash identity and mangled the displayed name to "Steam Deck Controllerggg" on every host tested. An 'F'-leading serial passes, so switch to "FVPF..." — keeps the PunktFunk marker one slot in, still distinct from a real Deck's "FVZZ..." for the Linux self-detection in physical_steam_controller_present(). The name now shows a clean "Steam Deck Controller" with a serial-derived handle (verified on .173). Also fix the UMDF driver's 0xAE GET_STRING_ATTRIBUTE handler to echo the requested attribute id faithfully instead of collapsing board-serial (0x00) requests to unit-serial (0x01). Steam still logs a benign "Deck Controller PCB Serial# invalid" for the board serial — it validates that against a Valve-internal format for ANY value, including an empty one (verified) — but that line does not mangle the name, change the handle, or block promotion. Applied to both transports: host inject/proto/steam_proto.rs::deck_serial (Linux gadget/usbip) and the pf-dualsense UMDF driver (Windows), which mirror each other's serial format. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 16:31:07 +02:00
enricobuehler	d8e8529cd7	feat(gamepad): Windows Steam Deck backend — Steam-Input-promoted UMDF virtual Deck ... The N4 GO verdict, productized. GamepadPref::SteamDeck on a Windows host now builds a real virtual Deck instead of folding to DualSense: games get native Deck glyphs + both trackpads + gyro + all four back grips through Steam Input's own remapping. - steam_deck_windows.rs: DeckWinPad/DeckWinProto/SteamDeckWindowsManager over the sealed shm channel, sharing the whole Linux Deck codec (steam_proto now compiles on Windows too — it was already pure). The SwDevice identity carries usb_mi: Some(2): the &MI_02 hardware-id token hidclass mirrors into the HID child and Steam parses as the wired controller interface — the promotion gate. - Driver: DEVTYPE_STEAMDECK (3) graduates from the spike — SET_FEATURE 0xEB rumble / 0x8F haptic pulses are republished to the host through the output slot (report-id-0 prefixed, so parse_steam_output sees the Linux wire shape), and the 0xAE/GET_STRING serial + 0x83 unit id are per-pad (read from the section's pad_index; PFDK<unit-id> matches steam_proto::deck_serial). - Router: SteamDeck arms in the Windows Pads paths; pick_gamepad flips SteamDeck-if-windows -> SteamDeck (the DualSense fold retires); dualsense-windows-test grows --deck. ON-GLASS VALIDATED on .173 (rebuilt signed driver 9.9.0714.12xx installed, Steam live): the manager-created pad (index 1) enumerates with per-pad serial PFDK50460001, Steam logs Interface: 2 -> '!! Steam controller device opened' -> 'Steam Controller reserving XInput slot 0' -> PollState 2 (actively polling our cycling input frames) -> mapping activated; clean teardown on exit. Rumble round-trip through a real game remains an on-glass debt (nothing sent 0xEB during the idle hold). Known gap vs Linux: no physical-Steam-controller conflict degrade on Windows yet (degrade_steam_on_conflict is Linux-only — /sys scan); a Windows equivalent needs SetupDi enumeration and is deferred. Verified: .21 clippy -D warnings + 304/0 tests + fmt --all; .133 clippy -D warnings + the WDK driver-workspace check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 12:36:26 +02:00
enricobuehler	4201851c7f	fix(fmt) + feat(gamepad): CI-matching rustfmt everywhere, enforced by repo git hooks; N4 spike flips to GO via MI_02 ... Three things that belong together: 1. rustfmt the gamepad-new-types host files ci.yml's `cargo fmt --all --check` gate flags (the .21/.133 verify recipes ran clippy+tests but never fmt — the same class of miss as 69f30f30). 2. Enforce it at the source: scripts/git-hooks/{pre-commit,pre-push} run the exact CI fmt gates (main workspace + the shipped-driver crates of the UMDF workspace); CONTRIBUTING documents the one-time `git config core.hooksPath scripts/git-hooks`. pre-push is the enforcement point (plumbing commits bypass pre-commit). 3. N4 follow-up — the spike verdict FLIPS TO GO: SwDeviceProfile grows `usb_mi`, synthesizing `&MI_02` into the Deck spike's USB hardware ids. hidclass mirrors the parent's USB tokens into the HID child's hardware ids, and hidapi/SDL/Steam parse `MI_` as bInterfaceNumber (defaulting to 0 when absent — the exact gate the first run hit: Steam wants the Deck controller on interface 2). Re-run live on .173: Steam logs `Interface: 2`, then `!! Steam controller device opened`, `Steam Controller reserving XInput slot 0`, and activates a mapping — full Steam Input promotion of the software-devnode Deck, no driver change needed. The PS identities pass `usb_mi: None` (real single-interface devices carry no MI_ token). A proper Windows-Deck backend phase is now justified; planned separately. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 12:20:33 +02:00
enricobuehler	ea2e3578e2	feat(gamepad): dualsense-windows-test grows --edge (drives device_type 2, cycles R4/L4) ... Used for the .173 on-glass verify: the Edge devnode enumerates (SWD\PUNKTFUNK\PF_EDGE_1, driver pf_dualsenseedge attaches, proto 2), and Steam's live controller.txt confirms the identity end to end — 'type: 054c 0df2', 'Product: DualSense Edge Wireless Controller', 'Controller using HIDAPI driver, vid=0x054c, pid=0x0df2' — with probe lightbar/player-LED feedback flowing back on the 0xCD plane. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 11:50:06 +02:00
enricobuehler	8d8168b0e0	feat(gamepad): N4 spike kit — software-devnode Steam Deck probe for Windows ... The gamepad-new-types §6 go/no-go rig, ready to run the moment .173 is back (the box is currently down, so the observation itself is still owed): does Steam Input on Windows promote a software-devnode HID Deck (28DE:1205), or does it need a real USB bus identity (the documented GameInput instance-path gap — the Linux 'Interface: -1' lesson)? - Driver: scratch device_type=3 serves the Deck identity — the captured 38-byte controller-interface descriptor, 28DE:1205 attributes, Valve strings, the Deck neutral frame, and the Steam 0x83/0xAE feature contract (SET_FEATURE latches the command, GET_FEATURE answers it — attribute blob + unit serial mirroring steam_proto::feature_reply). Never stamped by a session. INF gains pf_steamdeck. - Host: deck_spike_hold() + the `deck-windows-spike` subcommand — stamps devtype 3, spawns the devnode under VID_28DE&PID_1205, streams the neutral frame, prints what to observe (Steam logs/controller.txt, controller settings) and logs any output reports Steam writes. Run recipe (on .173, once the updated signed driver is staged): install driver, start Steam, `punktfunk-host.exe deck-windows-spike`, watch controller.txt. GO -> plan a proper N4 phase (the Deck codec is already shared); NO-GO -> document next to the Linux Interface:-1 note and keep the SteamDeck->DualSense Windows fold. Verified: .133 clippy -D warnings + the driver workspace cargo check (WDK) both green; .21 clippy + 304/0 tests unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 11:44:59 +02:00
enricobuehler	8c854e0a19	feat(gamepad): classic Steam Controller backend — Linux UHID via hid-steam (N3) ... The reserved GamepadPref::SteamController = 5 slot goes live: the same hid-steam driver under the wired-SC identity (28DE:1102, ID_CONTROLLER_STATE), UHID-only in v1 (no captured SC USB interface layout, so no Steam-Input promotion — the pre-usbip Deck state; acceptable for discontinued hardware). Layout pinned against the kernel's ID_CONTROLLER_STATE table: 24-bit buttons at 8..11 (low bits shared with the Deck; grips at 9.7/10.0 = the Deck's L5/R5 positions; right-pad click 10.2; joystick click 10.6), u8 triggers at 11/12, the joystick/left-pad MULTIPLEX at 16..20 (a left-pad contact shadows the stick, like real hardware's lpad_touched flag), right pad at 20..24. Mapping: wire left stick -> SC stick; wire right stick -> right-pad coords + touched bit (the SC's camera surface — the second-stick loss is inherent); PADDLE1/2 -> the two grips (natively, masked out of the fold input); PADDLE3/4 + MISC1 -> the remap policy. The SC parser has NO gamepad_mode gate, so no mode-entry pulse. SteamDeckPad grew a SteamModel (open_model); ScProto/SteamCtrlManager; pick_gamepad flips SteamController -> itself on Linux (replacing the Xbox360 fold); SDL picker splits Valve PIDs (Deck 1205 stays SteamDeck, SC 1102/1142 now declare SteamController). Verified: .21 clippy -D warnings + 304/0 tests + on-box UHID smoke (hid-steam binds 1102, BTN_A + right-pad ABS_RX land on evdev, no mode pulse); .133 clippy -D warnings green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 11:15:54 +02:00
enricobuehler	70a74b0d7c	feat(gamepad): Switch Pro backend — Linux UHID via hid-nintendo (N2) ... A virtual Pro Controller (057E:2009, BUS_USB, verbatim 203-byte USB descriptor triple-cross-checked from real-device captures) bound by hid-nintendo (>= 5.16): Nintendo-family client pads get correct glyphs + POSITIONAL layout (wire south/east/west/north -> Switch B/A/Y/X, so the physical-position <-> glyph relationship survives), live gyro/accel, and HD-rumble feedback — instead of folding to Xbox360 (mirrored A/B + X/Y, no motion). - switch_proto: report-0x30/0x21/0x81 codec + the entire canned probe conversation, pinned line-by-line against hid-nintendo.c: 0x80-family USB acks, device info (type 0x03 + per-pad MAC), SPI-flash calibration blobs (user magics ABSENT -> factory path; sticks 2048 +/- 1400 with the left/right byte-order difference; IMU offsets 0 + the driver's own default scales so raw units pass 1:1), rumble amplitude decode through the driver's inverted joycon_rumble_amplitudes table, player lights -> 0xCD PlayerLeds. 11 new pin tests. - switch_pro: UHID backend answering the probe from the manager's service pass; SwitchProManager = UhidManager<SwitchProProto> (the 8 ms heartbeat doubles as the steady 0x30 stream the driver's post-probe rate limiter wants). switchpro-test CLI smoke. - Router/fold: SwitchPro arms; pick_gamepad SwitchPro -> itself on Linux; degrade_if_no_uhid covers it. SDL picker: NintendoSwitchPro + JoyconPair declare SwitchPro. Headless-validated on .21 (hid-nintendo 7.1): probe completes ('using factory cal' for sticks + IMU, player-1 LED round-trips to the 0xCD plane), gamepad + IMU input devices created, and an evdev capture pins the positional swap (wire A/B -> BTN_SOUTH/BTN_EAST) + full-range stick scaling. .21 clippy -D warnings + 303/0 tests; .133 clippy -D warnings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 11:05:28 +02:00
enricobuehler	1830e095f8	feat(gamepad): DualSense Edge backend — Linux UHID + Windows UMDF (N1) ... The plain-DualSense transport + report codec under the Edge USB identity (054C:0DF2, verbatim 389-byte real-device descriptor cross-checked against the raw usbmon capture + hhd's production virtual Edge), so the wire back grips (BTN_PADDLE1..4: Deck L4/L5/R4/R5, Elite P1-P4) land on the Edge's NATIVE buttons[2] bits instead of the fold/drop policy: PADDLE1/2 -> the right/left back buttons, PADDLE3/4 -> the right/left Fn buttons (kernel BTN_TRIGGER_HAPPY1..4 on >= 7.2; SDL/Steam read hidraw on any kernel). - proto: Edge descriptor + btn2 bits + edge_paddle_bits(), pinned against hid-playstation DS_EDGE_BUTTONS_* and SDL_hidapi_ps5 (tests). - Linux: DsUhidIdentity parameterizes the UHID create; DsEdgeLinuxProto / DualSenseEdgeManager. Headless-validated on .21 (7.1): driver=playstation binds 0DF2, all 4 input devices created, probe lightbar/player-LED feedback round-trips; dualsense-test grew --edge (cycles all 4 paddles). - Windows: UMDF driver serves device_type=2 (Edge descriptor/attrs/strings, DS feature blobs); WinDsIdentity parameterizes the SwDevice profile + devtype stamp; DsEdgeWinProto / DualSenseEdgeWindowsManager; INF gains pf_dualsenseedge. Driver change => resign + reinstall before on-glass. - Router: DualSenseEdge arms in route_handle/apply_rich/pump/heartbeat; pick_gamepad folds Edge -> itself on linux||windows; degrade_if_no_uhid covers it. - Client (SDL): 054C:0DF2 declares DualSenseEdge (no distinct SDL type); Edge physical pads take the raw DS5 effects path; console-UI glyphs = Shapes. Apple/Android pickers follow separately. Verified: .21 clippy -D warnings + 292/0 host tests + on-box UHID bind smoke; .133 clippy pending in this push. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:49:31 +02:00
enricobuehler	45bde370e2	feat(gamepad): GamepadPref wire bytes for DualSense Edge (7) + Switch Pro (8) ... Phase 0 of gamepad-new-types: the two new kinds exist on the wire (enum, to_u8/from_u8/from_name/as_str, C-ABI constants + header), and pick_gamepad folds them to the closest EXISTING backend until their own backends land — DualSenseEdge -> DualSense (keeps the rich planes; only the paddles go through the fold policy), SwitchPro -> Xbox360. Wire round-trip pinned 0..=8 + unknown->Auto; fold table extended. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 10:20:24 +02:00
enricobuehler	650acda334	chore(inject): post-extraction sweep (3.3) ... Drop the vestigial Ds4Feedback.hidout field (parse_ds4_output never filled it and neither DS4 manager read it — the lightbar rides the led field, now converted to a HidOutput::Led by the protos) and its now-unused HidOutput import; refresh the pad_gate module doc (managers now drive it via pad_slots). Verified: .21 clippy --all-targets -D warnings + full suite 290 pass / 0 fail + cargo fmt --check clean; .133 clippy --all-targets -D warnings EXITCODE 0. Part of G12/3.3 (§3a.4 commit 10) — extraction complete. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 02:04:51 +02:00
enricobuehler	89aa52bc58	refactor(inject): uinput + XUSB managers onto PadSlots (3.3) ... The two stateless backends keep their structs and special pumps (uinput FF-effect mixing via pump_ff/last_mix; the XUSB stale-residual RUMBLE_IDLE_TIMEOUT force-off) but delegate slot lifecycle — table, unplug sweep, gate-checked create — to the shared PadSlots. XUSB resets last_rumble/last_active on the swept indices and on fresh create exactly as before (the G10/G16-adjacent semantics untouched). Two accepted deltas, both flagged in the plan (§3a): the uinput arrival/unplug log lines gain the pad-identity label every other backend already has ("controller arrival (X-Box 360 pad)"), and XUSB's f.index.max(0) clamp is replaced by the bounds check every other manager uses — a negative wire index is now dropped instead of being treated as pad 0. Verified: .21 clippy --all-targets -D warnings clean + full suite 290 pass / 0 fail (uinput); .133 clippy --all-targets -D warnings EXITCODE 0 (XUSB). Part of G12/3.3 (§3a.4 commit 9) — all seven managers now share the PadSlots lifecycle. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:57:00 +02:00
enricobuehler	384fc30833	refactor(inject/linux/steam_controller): convert to UhidManager<SteamProto> (3.3) ... The most hook-laden conversion: SteamControllerManager becomes a pub type alias of UhidManager<SteamProto>. The Steam-specific pieces map cleanly onto the trait — open() delegates to open_transport (usbip → gadget → UHID fallback, which keeps its own per-transport logging, so no extra success line, matching the old ensure), merge_frame preserves the trackpad coords/touch-bits/clicks + motion across button-only frames (the G2 fix, verbatim), and the gamepad-mode-entry pulse rides the force_heartbeat hook. DeckTransport goes pub (type Pad in a public-trait impl). Also un-fuses a doc-comment glitch where the manager's doc had been merged onto the DeckTransport enum. Verified on .21: clippy --all-targets -D warnings clean; full suite 290 pass / 0 fail. Part of G12/3.3 (§3a.4 commit 8) — all five stateful managers now share one skeleton. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:41:21 +02:00
enricobuehler	365d4bb8f1	refactor(inject/linux/dualshock4): convert to UhidManager<Ds4LinuxProto> (3.3) ... DualShock4Manager becomes a pub type alias of UhidManager<Ds4LinuxProto> (the same shape as the other three DS-family conversions); the bespoke last_led lightbar dedup folds into the shared HidoutDedup exactly as the Windows DS4 conversion did. With 3.3.0 already applied, the proto half is byte-identical to Ds4WinProto except the transport open — the codec, the mappers, and now the manager all shared. Verified on .21: clippy --all-targets -D warnings clean; full suite 290 pass / 0 fail. Part of G12/3.3 (§3a.4 commit 7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:38:45 +02:00
enricobuehler	f1efd3091e	refactor(inject/windows/dualshock4): convert to UhidManager<Ds4WinProto> (3.3) ... DualShock4WindowsManager becomes a pub type alias of UhidManager<Ds4WinProto>. The bespoke last_led lightbar dedup folds into the shared HidoutDedup: the proto's service() converts Ds4Feedback.led into a HidOutput::Led, and HidoutDedup compares it against the last-forwarded value with the same reset-on-create/unplug semantics the Option<(u8,u8,u8)> vec had. Everything else mirrors the DualSense conversion (same DsState mappers as linux/dualshock4.rs). Ds4WinPad goes pub (type Pad in a public-trait impl, E0446 otherwise). Verified on the Windows CI VM .133: cargo clippy -p punktfunk-host --all-targets -- -D warnings EXITCODE 0 at this tip. Part of G12/3.3 (§3a.4 commit 6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:36:45 +02:00
enricobuehler	446818eea6	refactor(inject/windows/dualsense): convert to UhidManager<DsWinProto> (3.3) ... DualSenseWindowsManager becomes a pub type alias of UhidManager<DsWinProto>; the proto supplies the UMDF sealed-channel open (+ success log), the DsState mappers (identical to linux/dualsense.rs, paddle fold included), and the section feedback poll. Lifecycle, dedup, and heartbeat come from the shared skeleton — behavior-identical, same log lines (LABEL DualSense/Windows + the driver-install hint). DsWinPad goes pub (it appears as type Pad in the impl of the public PadProto trait — E0446 otherwise; the Linux pads were already pub). Verified on the Windows CI VM .133 (same pinned 1.96.0 MSVC toolchain + Public-path FFmpeg/LLVM the runner uses): cargo clippy -p punktfunk-host --all-targets -- -D warnings EXITCODE 0 at the DS4-conversion tip (.173 was down; .133 carries the identical toolchain). Part of G12/3.3 (§3a.4 commit 5). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:36:45 +02:00
enricobuehler	4d6c2394dc	refactor(inject/linux/dualsense): convert to UhidManager<DsLinuxProto> (3.3) ... The first backend onto the shared skeleton: DualSenseManager becomes pub type DualSenseManager = UhidManager<DsLinuxProto>, where DsLinuxProto supplies only the protocol half (UHID open + success log, DsState neutral/merge/apply_rich with the paddle fold, best-effort write, the GET_REPORT-answering service pass). handle/apply_rich/heartbeat/pump and the unplug sweep now come from uhid_manager — behavior-identical (same log lines, same dedup + reset semantics), zero Pads-router edits. Verified on .21: clippy --all-targets -D warnings clean; full suite 290 pass / 0 fail. Part of G12/3.3 (§3a.4 commit 4). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:10:42 +02:00
enricobuehler	2bea02b0ea	feat(inject): generic PadProto + UhidManager<B> stateful manager (3.3 layer 2) ... The shared skeleton of the five stateful UHID/UMDF managers (Linux DualSense / DualShock 4 / Steam Deck, Windows DualSense / DualShock 4), written once over PadSlots: event routing with the unplug sweep and was-the-unplug early return, the merge-preserving frame fold, rich-input application, the silence heartbeat (with a backend force hook for the Steam mode-entry pulse), and the feedback pump with rumble dedup + HidoutDedup. A backend supplies only its per-controller half via PadProto: open / neutral / merge_frame / apply_rich / write_state / service — exactly where the real protocol differences live. Method surface (new/handle/apply_rich/pump/heartbeat) matches what the punktfunk1.rs Pads router already drives, so each backend will convert as a pub type alias with zero router edits. Additive only — no backend converted yet. 8 mock-backend tests make the manager lifecycle unit-testable for the first time; G2 (rich fields survive a button-only frame) and G10 (Arrival eager-creates) are now generic regression tests, plus removal-frame no-recreate, absent-pad rich drop, create-backoff state tracking, rumble/hidout dedup + re-arm on recreate, and heartbeat gap/force semantics. Verified on .21: clippy --all-targets -D warnings clean; suite 293 pass / 0 fail (285 prior + 8 new). Part of G12/3.3 (gamepad-review-cleanup.md §3a.3, commit 3 of the §3a.4 sequence). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:08:25 +02:00
enricobuehler	528a51d75c	feat(inject): shared PadSlots<P> slot table + lifecycle (3.3 layer 1) ... The Vec<Option<Pad>> slot table, active_mask unplug sweep, and PadGate- checked create that all seven backend managers copy-paste, extracted into one unit-tested inject/pad_slots.rs (cfg any(linux,windows), like pad_gate). sweep() returns the swept indices as a bitmask and ensure() returns fresh-create, so managers reset their per-index sibling state (state / last_rumble / dedup / clocks) without closure gymnastics. Lifecycle log lines are label/device/hint-parameterized to stay byte-identical per backend; open() keeps the success line (it knows the transport detail). Additive only — no manager converted yet; first unit coverage for the sweep/create lifecycle (5 tests: freshness, sweep-once semantics, gate integration, recreate, pump iteration). Verified on .21: clippy --all-targets -D warnings clean; suite 285 pass / 0 fail (280 prior + 5 new). Part of G12/3.3 (gamepad-review-cleanup.md §3a.3, commit 2 of the §3a.4 sequence). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:04:22 +02:00
enricobuehler	b597bb74bd	fix(inject/linux/ds4): fold the Linux DS4 backend onto the shared proto codec (3.3.0) ... The Linux DualShock 4 backend missed the G2-era shared-mapping work and drifted from dualshock4_proto three ways, leaving two user-visible gaps on the DS4 kind (Windows, written later against the proto, is correct): - its serialize_state duplicated the proto's byte-for-byte EXCEPT byte 7: raw st.buttons[2] instead of buttons2_with_click(), so a rich-plane pad click never reached the report; - its inline apply_rich never set touch_click and dropped the Steam LEFT pad entirely (surface 1 skipped), where the shared dualsense_proto::DsState::apply_rich splits the one touchpad left/right; - handle() didn't preserve touch_click across button-only frames. Net effect: Deck client -> Linux host on the DS4 kind = pad clicks and the left pad dead. Delete the local serialize_state/parse_ds4_output/Ds4Feedback/pack_touch and touch-dim consts in favor of dualshock4_proto (dropping the proto's keep-in-sync FIXME), route rich events through the shared DsState::apply_rich, and preserve touch_click in the frame merge exactly like the other three DS-family managers. The proto's serialize_offsets test gains a touch_click case pinning byte 7 bit 1. Verified on .21: cargo clippy -p punktfunk-host --all-targets -D warnings clean; full suite 277 pass / 0 fail. Pre-step 3.3.0 of the G12 skeleton extraction (gamepad-review-cleanup.md §3a.2) — the behavior fix lands before the mechanical dedup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 01:01:37 +02:00
enricobuehler	94802795e7	Merge branch 'gamepad-apple-cleanup': cross-client + host gamepad review cleanup (G1–G25) ... 48-finding cross-client + host gamepad audit (2026-07-13). Apple/Android/SDL-core capture + feedback and the Linux/Windows host injectors: held-guide release, the permanent broken-latch cliff (PadGate), Steam Deck trackpad clicks, DualSense mute, Windows DS/DS4 paddle fold, uinput button re-sync, gamestream BTN_* dedup, the dead Windows shell fork, legacy-Deck rumble ceiling, XUSB arrival, ARM64 fences, the truncate-everywhere value convention, and more. See punktfunk-planning/design/gamepad-review-cleanup.md.	2026-07-13 22:29:41 +02:00
enricobuehler	1af11cc64d	fix(inject/host/windows): order the pad change-detect fields with Release/Acquire (G21) ... The XUSB `packet` publish and the XUSB `rumble_seq` / DualSense `out_seq` reads used plain unaligned accesses with no fence, so a driver could observe a bumped change-detect field over a torn body on a weakly-ordered core (ARM64). Publish `packet` via a Release AtomicU32 store behind a Release fence, and Acquire-load the seq fields, mirroring the gamepad_raii PadChannel seq-fence precedent. The DualSense input report embeds its seq mid-report with no driver-gated change-detect field, so it gets a Release fence after the copy and a documented residual (a per-frame input generation is deferred). No-op on x86-TSO. Verified: Windows .173 `cargo clippy -p punktfunk-host --all-targets -- -D warnings` (green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 22:05:13 +02:00
enricobuehler	2f214532d9	fix(inject/host/windows): eager-create the XUSB pad on Arrival + refresh last_active (G10) ... The XUSB manager's `handle` dropped `GamepadEvent::Arrival` via a `let else`, so the GameStream path never created the pad until the first `State` and missed the first XInput poll. Match on the event and `ensure` eagerly on Arrival, mirroring the DualSense backend. Also refresh `last_active` on create and unplug so a freshly-created pad's residual-rumble idle clock starts fresh rather than inheriting a stale Instant (which could force off a legitimate rumble at once). Verified: Windows .173 `cargo clippy -p punktfunk-host --all-targets -- -D warnings` (green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 22:05:13 +02:00
enricobuehler	31bc863084	fix(inject/host/windows): free the per-section security descriptor (G19) ... `sddl_sa` leaked the `LocalAlloc`'d PSECURITY_DESCRIPTOR that ConvertStringSecurityDescriptorToSecurityDescriptorW returns, once per DATA section and once per bootstrap mailbox create (amplifiable under pad-flap via create_named's squat-retry loop). Wrap it in a `SecAttr` RAII owner that `LocalFree`s on drop; it outlives every CreateFileMappingW (the section copies the security info at create time), and create_named builds one and reuses it across retries instead of re-allocating. Verified: Windows .173 `cargo clippy -p punktfunk-host --all-targets -- -D warnings` (green) -- confirms the LocalFree/HLOCAL signature at the pinned windows-rs rev. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 22:05:13 +02:00
enricobuehler	e5166c6e6e	fix(host/steam): load vhci_hcd at boot on sysext hosts so the Deck pad is Steam-Input-promotable ... The virtual Steam Deck pad only appears in the host's Game Mode (and is navigable) when it arrives as a real USB device via the usbip/vhci_hcd transport — Steam Input won't promote the UHID hid-steam fallback (Interface: -1). The host runs as an unprivileged --user service, so it cannot modprobe vhci_hcd itself; the module must be loaded at boot and the vhci attach/detach sysfs files chgrp'd to the `input` group by the udev rule. Packaging ships modules-load.d/punktfunk.conf + 60-punktfunk.rules under the sysext's /usr/lib, but a systemd-sysext image MERGES after systemd-modules-load and early udev have already run, so on a plain reboot of a sysext host (e.g. Bazzite) those files are read too late: vhci_hcd is never loaded, usbip fails, and the pad silently degrades to non-promoted UHID — the controller vanishes from Game Mode. (deb/arch/rpm are unaffected: real /usr is present at early boot.) Fix: sysext post_merge now mirrors BOTH files into real /etc (read at the normal early-boot time, shadowing the /usr copies by filename; refreshed every merge since neither is user config), then reloads udev, modprobes vhci-hcd, and re-triggers the vhci platform device for the live session. Also raise the UHID-fallback log INFO->WARN with an actionable hint. Verified on the .41 sysext host: after the /etc mirror, unloading vhci_hcd and restarting systemd-modules-load (the real reader of /etc/modules-load.d) reloads the module; a udev coldplug trigger makes attach/detach root:input 0660; the unprivileged host user can then write attach — the exact working precondition for the usbip transport, now durable across reboot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 17:41:51 +02:00
enricobuehler	59fc820226	perf(inject/host): dedup the DualSense HID-output feedback plane (G17) ... A game's DualSense output report bundles rumble + lightbar + player-LEDs + adaptive-triggers into one report, so a pad that is merely rumbling re-sends its unchanged lightbar / LED / trigger state on every output report. The managers already dedup rumble, but forwarded every rich `HidOutput` event verbatim — flooding the 0xCD feedback plane to the client during continuous rumble. Add a shared `HidoutDedup` (dualsense_proto, used by both the Linux UHID and Windows UMDF managers) that forwards Led/PlayerLeds/Trigger only on a value change (per side for the two triggers) and always forwards one-shot TrackpadHaptic pulses — mirroring the rumble dedup two lines above and the DS4 backend's lightbar dedup. Reset per pad on create/unplug. Verified on Linux .21 (clippy -D warnings clean, new HidoutDedup unit test + full suite green); Windows .173 with the rest of Phase 3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 14:14:28 +02:00
enricobuehler	d611645ffc	refactor(inject/host/windows): hoist the shared SwCreateCtx into gamepad_raii (G14) ... The `SwDeviceCreate` completion-callback context (`SwCreateCtx`, the `sw_create_cb` extern callback, and the `instance_id()` accessor) was copy-pasted byte-for-byte in the XUSB (`gamepad_windows.rs`) and DualSense/DS4 (`dualsense_windows.rs`) backends. Hoist the one copy into `gamepad_raii.rs` as `pub(super)`; both `create_swdevice` bodies now build the shared type and pass the shared callback. Prunes the now-orphaned HRESULT/SetEvent/HANDLE imports from the two siblings. Pure move + dedup, no behavior change. Windows-verified with the rest of Phase 3 (clippy --all-targets -D warnings). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 14:08:00 +02:00
enricobuehler	17457cf4ba	refactor(gamestream/host): source gamepad BTN_* from punktfunk_core + pin the wire bits (G13/G15) ... `gamestream/gamepad.rs` hand-declared its own copy of the GameStream buttonFlags/buttonFlags2 layout, which had drifted from the single source of truth in `punktfunk_core::input::gamepad`: the click bits were named `BTN_LS_CLK`/`BTN_RS_CLK` (vs core's `…_CLICK`). The two layouts are bit-identical — GameStream/Limelight and the punktfunk/1 native wire are one contract — so define the gamestream names as `pub const` aliases of the core constants. Values now come solely from core (can't drift); kept as `pub const` (not a `pub use` re-export) because on Windows the only consumer — the Linux uinput button map — is cfg'd out, where an unused re-export lints as an error but an unused pub const does not. Rename the two injector call-sites (`inject/linux/gamepad.rs`) to the canonical `BTN_LS_CLICK`/`BTN_RS_CLICK`. G15 host half: replace the 3-bit gamestream-vs-core spot-check with an exhaustive golden-value test (`gamepad_wire_bits_are_pinned`) that freezes every button bit + axis id to its exact wire value, so renumbering a bit in core — which would silently break every shipped client — fails a test first. The host counterpart to the client-side C-ABI cross-checks. Verified on Linux .21: clippy -D warnings clean, pin test + gamepad suite green. (Windows verified together with the rest of Phase 3.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 14:08:00 +02:00
enricobuehler	6263108e15	fix(inject/host/windows): fold Steam back grips on the Windows DS/DS4 backends (G7) ... The Windows DualSense and DualShock 4 managers passed the raw wire buttons straight into `DsState::from_gamepad`, so a client's Steam back grips (BTN_PADDLE1..4) were silently dropped and `PUNKTFUNK_STEAM_REMAP` was ignored — the Linux DS/DS4 backends already fold them via `steam_remap::fold_paddles`. Bring the Windows backends to parity: add a `remap: steam_remap::RemapConfig` field (`::from_env()` in `new()`) to both managers and fold the paddles before `from_gamepad`, exactly as `linux/dualsense.rs` / `linux/dualshock4.rs`. Default policy stays Drop (don't fire buttons the user didn't ask for); set the env to map the grips onto stick-clicks or shoulders. `steam_remap` was gated `target_os = "linux"`; widened to `any(linux, windows)`. It's pure (only punktfunk_core + std::env); its Linux-only Deck motion rescale is `pub` so it compiles clean on Windows with no dead-code warning. Verified: Linux .21 (clippy -D warnings clean, inject tests 32 pass / 0 fail — the gate widening is a no-op there); Windows .173 (clean-recheck of punktfunk-host, cargo clippy --all-targets -D warnings EXITCODE 0, steam_remap + both managers compiling on Windows for the first time). On-glass with a real DualSense/DS4 + PUNKTFUNK_STEAM_REMAP still owed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 13:36:13 +02:00
enricobuehler	0c427cb3f1	fix(inject/host/linux): re-assert absolute gamepad button state each frame (G8) ... The uinput gamepad backend emitted only XOR-changed button edges while advancing `prev_buttons` unconditionally. Because `emit()` is best-effort (a full kernel queue silently drops the write), a dropped EV_KEY edge was never re-synced — the button stayed stuck (pressed-not-released, or vice versa) until it next toggled. The axes never had this problem: they re-emit their absolute value every frame. Re-assert every mapped button's absolute state each frame, exactly like the axes, and drop the now-unused `prev_buttons` field. Restating an unchanged key is free downstream: the kernel input core discards an EV_KEY whose value already matches the device's current state (no duplicate event reaches consumers, and BTN_* keys don't autorepeat). The `emit()` "next frame re-syncs state" comment is now honest for buttons too. Verified on the Linux host build (.21): cargo clippy -D warnings clean (no dead-field warning), full punktfunk-host suite 277 passed / 0 failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 13:14:02 +02:00
enricobuehler	5109a4c80a	refactor(inject/host): extract the shared PadGate create-retry policy + fix the permanent broken latch (G3/G12) ... All seven virtual-pad managers (Linux uinput/uhid: gamepad, dualsense, dualshock4, steam_controller; Windows XUSB/UMDF: gamepad, dualsense, dualshock4) carried an identical copy-pasted `broken: bool` latch that was set on the FIRST pad-creation error and never cleared — so a single transient failure (a startup race on /dev/uinput, a momentary EBUSY, the Windows companion driver not yet ready) permanently disabled EVERY controller for the rest of the session, even after the cause cleared. Extract that latch into one shared, unit-tested `PadGate` (inject/pad_gate.rs) with the fix baked in: capped exponential backoff (1s doubling to 30s) instead of a permanent kill. After a failure, creation is blocked only until the backoff elapses — so the manager no longer re-attempts (and re-logs) on every one of the 60–240 input frames/sec — then a single retry is allowed; a success resets the backoff. A genuinely broken setup therefore self-heals within one backoff window of the fix (udev reload / driver install / next client connect) with no host restart. The gate is manager-wide, matching the old flag's semantics (these failures are systemic, not per-slot). This folds G3 (broken latch) into G12 (dedup the manager skeleton): the latch now lives in one place across all seven backends. Verified on the Linux host build (.21): cargo clippy -D warnings clean, full punktfunk-host suite 277 passed / 0 failed, 4 new PadGate tests green. Windows managers verified separately on the x64 box. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 12:33:49 +02:00
enricobuehler	43e52437c0	fix(gamepad/host): map BTN_MISC1 to the DualSense mute button (G6) ... DsState::from_gamepad mapped GUIDE→PS and TOUCHPAD→TOUCHPAD into buttons[2] but never handled BTN_MISC1, so the mic-mute / capture button clients send was inert on every PlayStation-family virtual pad (DualSense/DualShock4), and btn2::MUTE was dead code. Map BTN_MISC1 → btn2::MUTE (rebuilt from the wire bit each frame like PS/TOUCHPAD, so no persistence gap) and drop the #[allow(dead_code)]. Test extended (from_gamepad_maps_touchpad_click); green on Linux (.21). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 12:04:59 +02:00
enricobuehler	2642ba6ad0	fix(gamepad/host): keep Steam Deck trackpad clicks across a button frame (G2) ... SteamControllerManager::handle rebuilds `SteamState.buttons` from the gamepad frame every tick via from_gamepad, preserving only the rich-plane TOUCH bits — so a held trackpad CLICK (set on the rich plane by apply_rich, stored in `buttons`) was wiped on the very next button/stick frame and only flickered back on the next rich event. This is the exact trap the DualSense backend already dodges by keeping click in a separate `touch_click` field. Mirror that: add persisted `lpad_click`/`rpad_click` bools to SteamState set by apply_rich (instead of pressing LPAD_CLICK/RPAD_CLICK into `buttons`), OR them into the report's click bits in serialize_deck_state, and preserve them across the rebuild in handle() like touch/coords/motion. RPAD_CLICK's other owner — the DualSense touchpad-click wire button via from_gamepad — stays in `buttons` and is OR'd at serialize, so the two sources release independently (a released BTN_TOUCHPAD can't strand a rich click, and vice-versa). Adds a regression test (rich_click_survives_a_buttons_rebuild). All 17 inject::{steam,dualsense,dualshock4}_proto tests pass on Linux (.21). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 12:04:59 +02:00
enricobuehler	644c035a34	feat(encode/amf): accept AMF runtime >=1.4.34 (graceful degrade) + log loaded amfrt64.dll identity ... The Windows AMF encoder hard-rejected any runtime <1.4.36 — a Jan-2025 (Adrenalin 25.1.1) driver floor. Every AMD host on an older driver failed the session with "update the AMD driver" after 8 retries, notably Boot Camp Macs whose bundled amfrt64.dll lags far behind. Split the single pin: - AMF_MIN_VERSION (1.4.34): the ABI floor accepted at load. Every vtable slot the FFI mirrors is a base-interface slot stable since well before 1.4.34; the 1.4.35/1.4.36-only features are string-keyed encoder properties already applied via set_prop(required=false), which log-and-continue — so an older driver degrades those features individually instead of failing. - AMF_HEADER_VERSION (1.4.36): the header the mirror targets, now passed to AMFInit capped at min(header, runtime) so claiming a version newer than the runtime can't make AMFInit reject an otherwise-usable older driver. No functionality removed: a >=1.4.36 runtime behaves exactly as before. Also logs, once per process, the AMF runtime version AND the loaded amfrt64.dll's full path + file-version resource (via GetModuleFileNameW + VerQueryValueW). This surfaces the Boot Camp failure mode where the display driver reads 25.x but the System32 amfrt64.dll is a stale build reporting an old AMF version; the too-old decline now names the DLL path/build and points at reboot + DDU reinstall. Not compile-verified: amf.rs is Windows-only and this Linux box can't cross-build it (a dependency's C build fails for the msvc target). Needs cargo check/clippy on the Windows build box / CI. rustfmt-clean; the windows-crate FFI signatures were verified against the on-disk 0.62.2 bindings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 01:32:51 +02:00
enricobuehler	05868ef634	fix(encode): Vulkan-HEVC full-RPS reference retention + AV1 feature gate (RFI review) ... 2026-07-12 review of the host encoders / client decoders / RFI plane. NVENC (both), AMF-LTR, the session glue, and the client RfiTracker came out clean; every fix lands in the Vulkan Video backend + dispatch: 1. HEVC: author each P-frame's short-term RPS to retain ALL resident DPB pictures (minus the setup slot), not just its one reference. HEVC 8.3.2 evicts unlisted pictures, and clients keep FEEDING the decoder while frozen — so with the old single-pic RPS, a conforming parser (FFmpeg = the Linux VAAPI/Vulkan and Windows D3D11VA clients) had already discarded the picture an RFI recovery anchor references whenever a fed post-loss frame preceded it: generate_missing_ref, and the "clean" anchor plus everything chained after it decodes as garbage. Pure builder (`build_h265_rps_s0`) + unit tests; AV1 needs nothing (slot-based retention). The smoke test now encodes a fed post-loss frame between loss@4 and anchor@6 so an ffmpeg decode of the dropped dump exercises exactly this (expect ONE POC-4 complaint, never POC 3) — revalidate on the AMD box; this NVIDIA dev box fails the backend earlier at HEVC header retrieval (pre-existing). 2. AV1: chain PhysicalDeviceVideoEncodeAV1FeaturesKHR (videoEncodeAV1 = TRUE, stype 1000513004) into device creation — spec-required for the ENCODE_AV1 codec op; RADV tolerated the omission, validation layers and stricter drivers do not. 3. RFI decline no longer self-arms force_kf — that bypassed the session glue's 750 ms IDR cooldown, turning a storm of hopeless RFI requests into one full IDR each. Decline like NVENC/AMF and let the caller's coalesced keyframe path own the fallback; add the missing first>last guard for parity. 4. open_video_backend now returns the label of the branch that ACTUALLY opened, so the mgmt API / web console reports "vulkan" instead of "vaapi" for the default-on Vulkan sessions (the old dispatch-mirror resolved_backend_label went stale when the backend gained its VAAPI fallback; deleted). Structure: the ~230-line inline HEVC coding block moves to record_coding_h265 (symmetric with record_coding_av1) and the duplicated pre-encode barriers dedupe into begin_encode_cmd. Follow-up plan (separate, punktfunk-planning): bring the post-loss freeze + RECOVERY_ANCHOR/POINT lift to the Android/Windows/Apple clients via a shared ReanchorGate (design/client-reanchor-freeze-parity.md). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-12 23:12:12 +02:00
enricobuehler	2d37835545	feat(encode): AV1 on the Linux Vulkan Video encoder (real RFI) ... Extend the raw Vulkan Video backend to AV1 (`VK_KHR_video_encode_av1`) alongside HEVC, so AMD/Intel Linux hosts get the same clean-P-frame loss recovery for AV1 that HEVC already has — no full IDR on packet loss. ash 0.38.0+1.3.281 predates the AV1-encode extension (finalized in Vulkan 1.3.290) and bumping ash breaks the SDL/Vulkan client (it drops the lifetime on AllocationCallbacks, which sdl3-sys still generates). So the AV1-encode structs/flags/enums are vendored host-only in `encode/linux/vk_av1_encode.rs`, copied verbatim from ash-master's generated code and chained into ash's generic video-encode calls via raw p_next — the common StdVideoAV1* types (from AV1 decode) are reused from ash 1.3.281. `vulkan_video.rs` gains a parallel AV1 path: AV1 Main profile/caps/session (+ max-level session-create), a bit-packed sequence-header OBU + per-frame temporal-delimiter framing (Vulkan AV1 encode, unlike H26x, emits only the frame OBU), and per-frame StdVideoEncodeAV1PictureInfo with the RFI reference model — a normal P inherits CDF context from its reference for compression, while an IDR or recovery anchor sets primary_ref_frame=NONE + error_resilient_mode so it decodes independent of the (possibly lost) frames since its reference. HEVC recording is unchanged; the shared CSC / ring / DPB-barrier pipeline is reused as-is. Codec routing in `open_video_backend` extends the HEVC arm to HEVC|AV1. The seq header enables only order-hint (+128px superblocks per caps), matching FFmpeg's proven Vulkan AV1 config — enabling CDEF/restoration made VCN emit frame-header sections our seq header didn't match, desyncing every inter frame. Headless-validated on real RADV (780M): open + 6-frame encode (I P P P P P) decodes 0-error on both dav1d and ffmpeg/cbs; the RFI recovery anchor at frame 4 is a clean P (not IDR), and dropping the "lost" frame 3 still decodes clean (re-anchored to frame 2). HEVC smoke unchanged (no regression). `cargo clippy --features vulkan-encode -- -D warnings` and the no-feature build both green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-12 22:06:24 +02:00
enricobuehler	76be4c3e12	feat(gamepad): multi-controller support on the native plane ... Host was already built for 16 pads; the blocker was every client hard-coding pad 0. This lands the host-side + reference-client contract: - input.rs: new wire kinds GamepadArrival=14 (declares a pad's type: code=GamepadPref byte, flags=pad) and GamepadRemove=13 (flags=seq<<24|pad, shares the snapshot seq space via encode/decode_gamepad_remove). - pf-client-core/gamepad.rs: reworked from a single `open` pad to a slots: Vec<Slot> model — every forwarded controller gets a stable lowest-free wire index held for its lifetime, per-slot held/axis/touch/ rumble state, GamepadArrival on open + GamepadRemove on close, and feedback routed back per wire index. Automatic forwards all real pads; a pin forces single-player. - punktfunk1.rs: replaced the single-session PadBackend enum with a Pads router — per-pad kinds[]/owner[] arrays, lazily-created per-kind managers, pure route_decision keeping a live device in its manager across a kind change (no ghost/dup). Input thread seq-gates GamepadRemove (clears the pad_mask bit, resets rumble) and applies GamepadArrival kinds. - inject linux/windows backends: add the two new no-op InputKind arms. Native/session + default-Windows clients (both spawn punktfunk-session) inherit this. 57 core + 33 client-core + 272 host tests green; clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:53:07 +02:00
enricobuehler	84329205eb	feat(encode): default-on the Linux Vulkan Video HEVC backend ... On-glass validated 2026-07-12 on an AMD RADV 780M with a real Deck-class client: the pipelined raw-Vulkan HEVC encoder ran a rock-solid 1080p@240 session and healed loss with clean P-frame recovery anchors (real RFI the libav VAAPI path can't express). Ship it on by default, mirroring the NVENC default-on. - vulkan_encode_enabled() defaults ON; PUNKTFUNK_VULKAN_ENCODE=0 is the libav VAAPI escape hatch. A failed open still falls back to VAAPI, so a device without h265 Vulkan encode (or an untested Intel/ANV that misbehaves at open) degrades gracefully instead of breaking the stream. - Ring depth defaults to 2 (one frame of overlap, lowest added latency — the on-glass-validated real-time setting); PUNKTFUNK_VULKAN_INFLIGHT still tunes it. - Compile --features punktfunk-host/vulkan-encode into the arch/deb/rpm host builds (pure-Rust ash, no new lib / no link-time dep), alongside nvenc. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-12 20:20:31 +02:00
enricobuehler	e9d8f2bc04	perf(encode): pipeline the Vulkan Video encoder (frames in flight) ... The Linux raw-Vulkan HEVC backend blocked on two GPU fences per frame, so CPU readback and the next capture could not overlap the GPU encode. Refactor into a small ring of per-in-flight-frame resources (own command buffers, CSC descriptor set + Y/UV/NV12 scratch, bitstream buffer, feedback query and sync objects) so submit() records into a free slot and returns without waiting, and poll() reads back the oldest slot once its fence signals. The pump's non-blocking poll then overlaps a frame's CSC+encode with the next capture — the throughput win — with no capturer/pump change (VAAPI untouched). - New `Frame` struct + `make_frame`; encoder holds `frames`/`ring`/`in_flight`. - `record_submit` (non-blocking) + `read_slot` (fence-gated readback) replace the synchronous `encode_frame`; `enqueue` applies backpressure by draining the oldest slot when the ring is full. - DPB self-barrier between consecutive encodes: orders frame N's reconstruct write before N+1's reference read now that they can be in flight together. - flush() drains all in-flight slots in order; reset() waits idle + discards. - Ring depth defaults to 3, overridable via PUNKTFUNK_VULKAN_INFLIGHT (2..=6). - Smoke test drains via poll-loop + flush (async breaks one-AU-per-submit). Headless-validated on real RADV 780M: cargo check (feature on/off) + clippy -D warnings + rustfmt clean; smoke test at ring depth 2/3/6 all ffmpeg-decode clean (I P P P P P) and drop-heal (I P P P P) with 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-12 19:51:21 +02:00